webPromedium
Lab 315 — PulseMetrics — SSRF Chain to SSTI via Internal Services
hackadvisor
Task: Flask monitoring platform with webhook integration feature allowing full-read SSRF. Solution: Chain SSRF to discover internal services, leak API key from debug endpoint, then exploit unsandboxed Jinja2 SSTI on authenticated admin report API for RCE.
$ ls tags/ techniques/
ssrf_via_webhookinternal_port_scanningdebug_config_disclosureauthenticated_ssrf_with_headersjinja2_ssti_rcecycler_globals_popen
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 127 — PulseMetric — Insecure Deserialization via Pickle in Agent Report API— hackadvisor
- [web][Pro]Lab 389 — PulseBoard — SSTI in Custom Widget Template Builder— hackadvisor
- [web][Pro]Lab 282 — StreamForge — SSRF via Webhook Test Bypasses Proxy Auth— hackadvisor
- [web][Pro]Lab 236 — PulseAlert — Blind SSTI via Notification Template Engine— hackadvisor
- [web][Pro]Lab 247 — PulseGuard — SSTI in Webhook Notification Templates— hackadvisor